Chore(deps): bump the github-actions group across 1 directory with 29 updates #1037
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: JS Test pipeline for PRs (Inference-addon-cpp) | |
| permissions: | |
| contents: read | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, labeled, ready_for_review] | |
| paths: | |
| - "packages/inference-addon-cpp/**" | |
| - ".github/workflows/pr-test-inference-addon-cpp-js.yml" | |
| workflow_dispatch: | |
| env: | |
| PKG_DIR: packages/inference-addon-cpp | |
| jobs: | |
| authorize-js-tests: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| statuses: read | |
| outputs: | |
| allowed: ${{ steps.auth.outputs.allowed }} | |
| steps: | |
| # SHA-bound fork approval. Reads the `qvac/fork-verified` commit status that | |
| # fork-approval records on the PR head after fork-ci environment approval. | |
| # Gating self-hosted fork runs on this status (not a stale label) is what stops | |
| # a draft->ready / close->reopen flip — or any later push — from running a new, | |
| # unapproved SHA. Read-only: no secrets, `statuses: read` only. See | |
| # .cursor/rules/devops/github-actions.mdc "CI trust policy for fork PRs". | |
| - name: Resolve SHA-bound fork approval | |
| id: approved | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| REPO: ${{ github.repository }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| STATUS_CONTEXT: qvac/fork-verified | |
| run: | | |
| approved=false | |
| if [ -n "$HEAD_SHA" ]; then | |
| state=$(gh api "repos/${REPO}/commits/${HEAD_SHA}/statuses" \ | |
| --jq "map(select(.context == \"${STATUS_CONTEXT}\"))[0].state // \"\"" \ | |
| 2>/dev/null || echo "") | |
| if [ "$state" = "success" ]; then approved=true; fi | |
| fi | |
| echo "approved=$approved" >> "$GITHUB_OUTPUT" | |
| - name: Authorize JS tests | |
| id: auth | |
| env: | |
| EVENT: ${{ github.event_name }} | |
| IS_FORK: ${{ github.event.pull_request.head.repo.full_name != github.repository }} | |
| IS_DRAFT: ${{ github.event.pull_request.draft }} | |
| HAS_RUN_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'run-desktop-addon-tests') }} | |
| HAS_APPROVED_SHA: ${{ steps.approved.outputs.approved }} | |
| run: | | |
| if [ "$EVENT" != "pull_request" ]; then | |
| echo "allowed=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| if [ "$IS_DRAFT" = "true" ]; then | |
| echo "::notice::Draft PR: JS tests skipped until ready-for-review." | |
| echo "allowed=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| # Internal same-repo PRs are trusted without fork-ci, but desktop | |
| # tests remain opt-in behind their dedicated capacity-control label. | |
| if [ "$IS_FORK" = "false" ]; then | |
| echo "allowed=$HAS_RUN_LABEL" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| # External fork: require the tier run-label AND a SHA-bound approval on | |
| # the CURRENT head (`qvac/fork-verified` commit status). A stale tier | |
| # label cannot authorise a new SHA via a draft->ready / close->reopen | |
| # flip, and a fork synchronize has no approved status until re-review — | |
| # both fail closed here. | |
| if [ "$HAS_RUN_LABEL" = "true" ] && [ "$HAS_APPROVED_SHA" = "true" ]; then | |
| echo "allowed=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "::notice::JS tests require 'run-desktop-addon-tests'; external forks also require a SHA-bound fork-ci approval (\`qvac/fork-verified\`) on the current commit. Approving fork-ci does not restart this run — approve first, then apply the label, or re-run this workflow if the label is already present. See docs/ci/LABELS.md." | |
| echo "allowed=false" >> "$GITHUB_OUTPUT" | |
| run-js-tests: | |
| needs: authorize-js-tests | |
| if: needs.authorize-js-tests.outputs.allowed == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: qvac-ubuntu2204-x64 | |
| platform: linux | |
| arch: x64 | |
| name: linux-x64-asan | |
| asan: true | |
| run_tests: true | |
| - runner: qvac-macos26-arm64-gpu | |
| platform: darwin | |
| arch: arm64 | |
| name: darwin-arm64 | |
| asan: false | |
| run_tests: true | |
| - runner: macos-15-large | |
| platform: darwin | |
| arch: x64 | |
| name: darwin-x64 | |
| asan: false | |
| run_tests: true | |
| - runner: qvac-win25-x64 | |
| platform: win32 | |
| arch: x64 | |
| name: win32-x64 | |
| asan: false | |
| run_tests: true | |
| runs-on: ${{ matrix.runner }} | |
| name: js-${{ matrix.name }} | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - name: Manual Workspace Cleanup | |
| run: rm -rf "$GITHUB_WORKSPACE" && mkdir -p "$GITHUB_WORKSPACE" | |
| shell: bash | |
| working-directory: . | |
| if: runner.environment != 'github-hosted' | |
| - name: Checkout source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # 7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: yamlfmt | |
| uses: ./.github/actions/yamlfmt | |
| with: | |
| workdir: ${{ env.PKG_DIR }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # 7.0.0 | |
| with: | |
| node-version: 22 | |
| - name: Install Bare tooling | |
| run: npm install -g --force bare bare-make | |
| - if: ${{ matrix.platform == 'win32' }} | |
| name: Setup CMake on Windows | |
| run: | | |
| cd .. | |
| # Persistent runners keep this parent dir between jobs (only $GITHUB_WORKSPACE | |
| # is wiped), so a leftover extraction makes a bare `unzip` prompt and fail. | |
| rm -rf cmake-3.31.6-windows-x86_64 cmake-3.31.6-windows-x86_64.zip | |
| curl -L https://github.com/Kitware/CMake/releases/download/v3.31.6/cmake-3.31.6-windows-x86_64.zip -o cmake-3.31.6-windows-x86_64.zip | |
| unzip -q cmake-3.31.6-windows-x86_64.zip | |
| echo "$PWD/cmake-3.31.6-windows-x86_64/bin" >> "$GITHUB_PATH" | |
| - if: ${{ matrix.platform == 'darwin' || matrix.platform == 'ios' }} | |
| name: Setup CMake on macOS | |
| run: | | |
| cd .. | |
| curl -L https://github.com/Kitware/CMake/releases/download/v3.31.6/cmake-3.31.6-macos-universal.tar.gz -o cmake-3.31.6-macos-universal.tar.gz | |
| tar -xzf cmake-3.31.6-macos-universal.tar.gz | |
| echo "$PWD/cmake-3.31.6-macos-universal/bin" >> "$GITHUB_PATH" | |
| - if: ${{ matrix.platform == 'android' }} | |
| name: Configure runner for cross compilation - Android | |
| run: | | |
| echo "ANDROID_TOOLCHAIN_ROOT=$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64" >> "$GITHUB_ENV" | |
| echo "ANDROID_NATIVE_API_LEVEL=34" >> "$GITHUB_ENV" | |
| - if: ${{ matrix.platform == 'win32' }} | |
| name: Configure CMake generator on Windows | |
| run: | | |
| echo "CMAKE_GENERATOR=Visual Studio 17 2022" >> "$GITHUB_ENV" | |
| echo "CMAKE_GENERATOR_PLATFORM=x64" >> "$GITHUB_ENV" | |
| - if: ${{ !matrix.asan }} | |
| name: Run JS integration packages | |
| run: | | |
| failures=0 | |
| failed_packages="" | |
| for package_dir in "${{ env.PKG_DIR }}"/tests/integration_js/*; do | |
| if [ ! -f "$package_dir/package.json" ]; then | |
| continue | |
| fi | |
| package_name="${package_dir##*/}" | |
| echo "::group::$package_name" | |
| if ( | |
| cd "$package_dir" | |
| npm install --package-lock=false --ignore-scripts | |
| npm run lint | |
| bare-make generate --platform ${{ matrix.platform }} --arch ${{ matrix.arch }} ${{ matrix.flags }} | |
| bare-make build | |
| bare-make install | |
| if [ "${{ matrix.run_tests }}" = "true" ]; then | |
| npm test | |
| fi | |
| ); then | |
| echo "$package_name passed" | |
| else | |
| echo "::error::$package_name failed" | |
| failures=1 | |
| failed_packages="$failed_packages $package_name" | |
| fi | |
| echo "::endgroup::" | |
| done | |
| if [ "$failures" -ne 0 ]; then | |
| echo "::error::Failed JS integration packages:$failed_packages" | |
| exit 1 | |
| fi | |
| - if: ${{ matrix.asan }} | |
| name: Run JS integration packages with ASAN | |
| run: | | |
| failures=0 | |
| failed_packages="" | |
| for package_dir in "${{ env.PKG_DIR }}"/tests/integration_js/*; do | |
| if [ ! -f "$package_dir/package.json" ]; then | |
| continue | |
| fi | |
| package_name="${package_dir##*/}" | |
| echo "::group::$package_name ASAN" | |
| if ( | |
| cd "$package_dir" | |
| npm install --package-lock=false --ignore-scripts | |
| npm run lint | |
| rm -rf build prebuilds | |
| CXXFLAGS="-fsanitize=address -fno-omit-frame-pointer" \ | |
| LDFLAGS="-fsanitize=address" \ | |
| bare-make generate --platform ${{ matrix.platform }} --arch ${{ matrix.arch }} ${{ matrix.flags }} | |
| bare-make build | |
| bare-make install | |
| if [ "${{ matrix.run_tests }}" = "true" ]; then | |
| LD_PRELOAD="$(cc -print-file-name=libasan.so)" \ | |
| ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:alloc_dealloc_mismatch=0 \ | |
| npm test | |
| fi | |
| ); then | |
| echo "$package_name ASAN passed" | |
| else | |
| echo "::error::$package_name ASAN failed" | |
| failures=1 | |
| failed_packages="$failed_packages $package_name" | |
| fi | |
| echo "::endgroup::" | |
| done | |
| if [ "$failures" -ne 0 ]; then | |
| echo "::error::Failed JS integration packages:$failed_packages" | |
| exit 1 | |
| fi |